CVE-2025-32023: Redis HyperLogLog RCE Vulnerability

CVE-2025-32023 is a remote code execution vulnerability in Redis affecting HyperLogLog operations from versions 2.8 to 8.0.2. Attackers can exploit stack/heap buffer overflows to execute arbitrary code. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-32023 Overview

Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.

Critical Impact
This vulnerability allows an authenticated user to execute arbitrary code, potentially compromising the server entirely.

Affected Products

Redis 2.8
Redis 7.4.5
Redis 7.2.10

Discovery Timeline

2025-07-07 - CVE-2025-32023 published to NVD
2025-09-05 - Last updated in NVD database

Technical Details for CVE-2025-32023

Vulnerability Analysis

The vulnerability arises from improper management of memory during hyperloglog operations, allowing an authenticated user to perform a stack/heap out of bounds write. This can be leveraged to execute arbitrary code within the context of the Redis server process.

Root Cause

The root cause is a failure in input validation within hyperloglog operations, allowing specially crafted strings to overwrite memory boundaries.

Attack Vector

The attack vector is local, requiring authenticated access to the vulnerable Redis instance to execute the malformed strings.

// Example exploitation code (sanitized)
char* malformed_input = "\\x00...\\x00";
hyperloglog_add(context, malformed_input);

Detection Methods for CVE-2025-32023

Indicators of Compromise

Unusual spike in memory usage
Application crashes or unexpected restarts
Unauthorized access attempts in logs

Detection Strategies

Utilize process monitoring to watch for unexpected hyperloglog command executions and analyze memory patterns that deviate from normal behavior. Implement log correlation to identify patterns of unauthorized access.

Monitoring Recommendations

Ensure comprehensive monitoring of Redis logs and configure alerts for anomalies related to hyperloglog operations. Leverage SentinelOne's advanced behavioral AI to detect unknown or zero-day exploits.

How to Mitigate CVE-2025-32023

Immediate Actions Required

Update Redis to version 8.0.3, 7.4.5, 7.2.10, or 6.2.19
Restrict hyperloglog operations via ACLs
Monitor for unauthorized access attempts

Patch Information

Patches are available as part of the updates to the affected versions. More information can be found in the official Redis release notes.

Workarounds

To mitigate the issue without immediate patching, configure ACLs to prevent execution of hyperloglog commands by unauthorized users.

bash

# Configuration example
grant +@hyperloglog ~* +@allchannels ~* +exec ~*